From Pixels to Power: China's Cybersecurity Strategy as a Mirror for European Vulnerability

Introduction

On 16 March 2026, the European Union Council imposed sanctions on two China-based entities – Integrity Technology Group and Anxun Information Technology, for cyberattacks targeting the critical infrastructure of multiple EU member states (Council of the EU, 2026). The decision, the first time the EU has sanctioned Chinese cyber actors on this scale, marked a watershed moment in European security politics. Yet it also exposed a deeper, more uncomfortable truth: Europe’s cyber defences remain structurally underprepared for the scale and sophistication of the threat it faces.

This paper argues that analysing China’s cyber strategy, not as an object of admiration or emulation, but as a diagnostic instrument that offers European policymakers a sharper picture of their own vulnerabilities. China’s comprehensive, institutionally integrated approach to cyberspace reveals, by contrast, the fragmented, underfunded, and asymmetrically governed nature of European cyber defence. The primary analytical lens here is European vulnerability assessment, with China’s approach serving as the comparative benchmark through which EU weaknesses become legible.

The argument proceeds in three stages. First, the paper outlines China’s cyber architecture and its key institutional innovations, particularly Military-Civil Fusion (MCF) and state-affiliated threat actor groups. Second, it maps Europe’s structural vulnerabilities across governance, infrastructure, and supply chains. Third, it draws out three actionable lessons for European security policymakers, grounded in specific institutional and legislative reforms.

China’s Cyber Architecture: An Integrated Strategic Instrument

China’s cyber capabilities have evolved far beyond ad hoc espionage into a coherent national strategy. At its institutional core is the Military-Civil Fusion (MCF) policy, elevated by Xi Jinping to a state strategy in 2014 and embedded into virtually every subsequent national plan, from Made in China 2025 to the 14th Five-Year Plan (McFaul, Bresnick and Chou, 2025). MCF dismantles the boundary between the civilian technology sector and military cyber operations, requiring universities, state-owned enterprises, and private firms to collaborate with the People’s Liberation Army (PLA) in developing dual-use technologies.

The institutional expression of this integration was, until 2024, the PLA Strategic Support Force (SSF), which centralised space, cyber, and information warfare under a single command (Kania and Costello, 2017). When the SSF was dissolved in April 2024 and its functions redistributed across a new Cyberspace Force (CSF) and Information Support Force (ISF) under direct Central Military Commission authority, it signalled not a retreat but a deepening of central control over cyber capabilities (US DoD, 2024). The ISF is now explicitly tasked with integrating AI-driven analytics, autonomous systems, and civilian expertise into real-time military network operations.

Operationally, this architecture has produced a sophisticated ecosystem of state-affiliated threat actors. Groups such as Volt Typhoon and Salt Typhoon, attributed by Western intelligence agencies to PLA-linked structures – have demonstrated a preference for long-term, low-signature access over immediate disruption (CISA, 2024). Salt Typhoon alone is reported to have infiltrated over 200 targets across more than 80 countries by 2025. In late 2025, the group attempted to breach a European telecommunications provider, exploiting vulnerabilities in Citrix NetScaler Gateway – part of a pattern in which intrusion techniques first tested against Southeast Asian targets subsequently appear in operations against Western infrastructure (The Diplomat, 2025).

The strategic objective is not necessarily immediate sabotage but what analysts term ‘pre-positioning’: embedding persistent access within critical infrastructure to create strategic leverage in the event of geopolitical crisis (CISA, 2024). Chinese cyber espionage operations surged by 150 per cent overall in 2024, with attacks on financial, manufacturing, and industrial sectors rising by up to 300 per cent (CSIS, 2025). Understanding this architecture is essential, not to replicate its authoritarian logic, but to diagnose what it reveals about European gaps.

European Vulnerability: A Structural Assessment

Fragmented Governance and Implementation Deficits

The EU’s primary legislative instrument for cyber resilience, the NIS2 Directive, was required to be transposed into national law by all 27 member states by 17 October 2024. In practice, only four states met that deadline (ECSO, 2025). By mid-February 2025, the number had risen to nine, and the European Commission opened infringement proceedings against 23 member states in November 2024. As of early 2026, over half of EU member states, including major economies such as Germany, France, and Poland,  had not completed transposition, meaning significant portions of European critical infrastructure operate without the cyber risk management obligations NIS2 mandates (Skadden, 2025).

This creates a multi-tiered compliance landscape within a nominally unified regulatory space. As ENISA’s 2024 NIS360 report noted, the public administrations sector (a prime target for state-sponsored cyber operations) remains in the early stages of cybersecurity maturity, lacking the institutional support seen in more regulated sectors such as banking and energy (ENISA, 2025). The fragmentation is not merely administrative: it is operationally exploitable. A threat actor seeking persistent access to EU networks need only identify the weakest national link in an interconnected infrastructure system.

Legacy Infrastructure and Operational Technology Exposure

European critical infrastructure carries a significant legacy burden. Communications networks, energy management systems, and public administration IT in many member states rely on operational technology (OT) deployed before the current threat landscape existed. Unlike IT systems, OT environments, which govern power grids, water treatment, and transport, were not designed with network security as a priority. ENISA’s NIS360 report specifically flags the gas sector and public administrations as lacking mature incident response capabilities, while the space sector is highlighted for its over-reliance on commercial off-the-shelf components with poorly understood integration risks (ENISA, 2025).

The consequences of these OT vulnerabilities are concrete. In 2024, a European mobile carrier suffered a Border Gateway Protocol (BGP) hijacking incident, demonstrating how traffic manipulation can be leveraged for espionage or disruption in a context of increasing network interdependence (HarfangLab, 2025). Crucially, China’s Volt Typhoon campaign specifically targets OT-adjacent environments rather than conventional IT networks, suggesting that China’s threat actors have already mapped and prioritised the gaps that European regulators have been slowest to address (CISA, 2024).

Supply Chain Dependency and Technological Sovereignty

A third structural vulnerability concerns supply chain exposure. European critical infrastructure, particularly in telecommunications and energy has incorporated Chinese-manufactured components, most visibly Huawei and ZTE equipment in 5G network buildouts. Germany’s phased rip-and-replace programme for Chinese telecommunications infrastructure, accelerated following the 2021 BfV cyberattack attributed to Beijing, illustrates both the depth of the dependency and the political difficulty of unwinding it (CSIS, 2024). This exposure is not incidental; it is a foreseeable consequence of procurement decisions made without adequate security screening.

The EU has begun to address this through its ICT Supply Chain Security Toolbox and the broader European Chips Act framework, but implementation remains uneven. ENISA’s NIS360 assessment notes that supply chain risk management is among the areas where entity-level maturity is weakest, particularly in sectors newly brought into NIS2 scope (ENISA, 2025). A January 2026 EUISS report on Chinese influence in European energy infrastructure further highlighted that the Netherlands – with rooftop solar comprising 15–16 per cent of electricity capacity – faces de-risking costs of 10–20 per cent when reducing reliance on Chinese photovoltaic supply chains (EUISS, 2026).

Lessons for European Policymakers

Lesson One: Unified Command Requires Unified Compliance

China’s cyber resilience derives in no small part from the elimination of institutional seams between civilian and military cyber functions. The EU cannot and should not replicate this through authoritarian centralisation, but it must address the governance seams that make European cyber defence exploitable. The most urgent step is closing the NIS2 transposition gap. The European Commission should move beyond infringement proceedings, which are slow – toward conditional linkage between NIS2 compliance and access to EU structural funds and Digital Europe Programme resources. ENISA’s role should be strengthened with enforcement support capacity, and the EU-CyCLONe crisis coordination mechanism must be tested under realistic cross-border scenarios, not merely formally constituted.

Lesson Two: OT Security Cannot Wait for IT Maturity

China’s pre-positioning doctrine deliberately targets OT systems in energy, water, and transport – actually because Western regulatory frameworks have treated IT and OT security as sequential rather than simultaneous priorities. The EU’s Critical Entities Resilience (CER) Directive addresses physical resilience but must be operationally integrated with NIS2’s cyber risk management obligations in a coherent, sector-by-sector framework. ENISA should develop binding OT-specific technical standards for the energy, transport, and water sectors by 2027, and member states should be required to conduct OT-specific vulnerability assessments – not merely IT audits – as part of NIS2 compliance reviews.

Lesson Three: Technological Sovereignty as a Security Imperative

China’s MCF strategy has made supply chain integrity a weapon, embedding potential access points within the technological dependencies of strategic rivals. Europe’s response must treat supply chain security not as a trade policy question but as a defence imperative. The EU’s 5G security toolbox must be fully implemented across all member states, with the Cyber Solidarity Act mechanisms used to fund supply chain diversification for high-risk sectors. Strategic autonomy in semiconductors, telecommunications, and AI infrastructure should be explicitly framed as a security investment, not merely an industrial policy goal. The European Chips Act and the EURO-3C project announced at MWC 2026 are meaningful steps; they must be accelerated and explicitly threat-indexed against documented state-actor capabilities.

Conclusion

The EU’s March 2026 sanctions on Chinese cyber actors represent an important signal of political resolve. But sanctions are reactive instruments; they address the symptom rather than the structural conditions that make European infrastructure a viable and attractive target. China’s cyber strategy, understood as a diagnostic mirror, reveals three compounding vulnerabilities: fragmented governance that leaves regulatory gaps between and within member states; legacy operational technology that was never designed to withstand state-level cyber intrusion; and supply chain dependencies that represent pre-embedded strategic risk.

Addressing these vulnerabilities does not require Europe to abandon its multi-actor, rule-of-law foundations, indeed, those foundations are part of what distinguishes European security governance from the centralised model China has built. But they do require that the EU treat cyber resilience with the same resource commitment, institutional priority, and strategic coordination it has historically reserved for conventional defence. As hybrid warfare becomes the defining security paradigm of 2026 and beyond, the cost of complacency is not theoretical. It is already being measured in breached ministries, compromised telecommunications, and strategic leverage ceded to revisionist powers.

References

CISA (2024) PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure. Washington, DC: CISA.

Council of the EU (2026) ‘Cyber-attacks against the EU and its member states: Council sanctions three entities and two individuals’, Press Release, 16 March. Available at: https://www.consilium.europa.eu (Accessed: 29 March 2026).

CSIS (2025) Significant Cyber Incidents. Washington, DC: CSIS Strategic Technologies Program. Available at: https://www.csis.org (Accessed: 29 March 2026).

ECSO (2025) NIS2 Directive Transposition Tracker. Available at: https://ecs-org.eu (Accessed: 29 March 2026).

ENISA (2025) NIS360 – 2024. Heraklion: ENISA.

EUISS (2026) The Dragon in the Grid: Limiting China’s Influence in Europe’s Energy System. Paris: EUISS.

HarfangLab (2025) 2025 Threatscape Report. Paris: HarfangLab.

Kania, E.B. and Costello, J.K. (2017) ‘The Strategic Support Force and the future of Chinese information operations’, Cyber Defense Review, 2(2), pp. 105–122.

McFaul, C., Bresnick, S. and Chou, D. (2025) Pulling Back the Curtain on China’s Military-Civil Fusion: How the PLA Mobilizes Civilian AI for Strategic Advantage. Washington, DC: Center for Security and Emerging Technology.

Skadden, Arps, Slate, Meagher & Flom LLP (2025) NIS2 Update: EU Cyber Authority Sets Out Compliance Expectations, but Implementation Is a Work in Progress. Available at: https://www.skadden.com.

The Diplomat (2025) ‘Southeast Asia: China’s Cyber Incubator and the Looming Day One Threat’, 23 October.

US Department of Defense (2024) Annual Report to Congress: Military and Security Developments Involving the People’s Republic of China 2024. Washington, DC: DoD.